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(U) North Carolina: Recent Spike in Election-related Physical and Cyber 
Incidents Against Political Institutions Likely to Decrease In the Short 
Term, but Threat Environment Remain Unpredictable 

(U//FOUO) Prepared jointly by the North Carolina Information Sharing and Analysis Center (ISAAC) and the DHS Office of 
Intelligence & Analysis (l&A). 

(U) Scope: This Field Analysis Report (FAR) provides situational awareness to state and local partners in North 
Carolina concerning criminal activities , physical violence, and cyber activity directed at government organizations 
following the conclusion of the 2016 election and political transition. It was written in response to a spike in 
violence and criminal acts — including an arson attack— targeting political party offices and staff that occurred 
prior to of and immediately following the election. In this context, this assessment provides an overall threat 
forecast for the first half of 2017 concerning like activities in the state. 

(U) Key Judgments 

• (U//FOUO) We assess that the number of incidents of low level physical violence directed toward 
political institutions in North Carolina — a short-term spike represented by such incidents as the 16 
October arson attack targeting a political headquarters — will likely decrease through the first half of 
201 7 as compared to the last half of 201 6. We base this conclusion on the lack of threat reporting 
and the completion of the Presidential election and the near completion of political transitions in 
federal and state governments which may have served as a drivng catalyst for the violence. We 
also cannot rule out that the spike in violence may have inspired others to conduct similar acts. 

• (U//FOUO) We assess malicious cyber activities directed at government networks will likely 
continue at a rate consistent to what has been observed in previous years; but will revert back to 
the criminal focus seen in the state previously, as opposed to the more politically-motivated activity 
seen in the end of the year duethe end of the election cycle. 

(U//FOUO) Likely Decrease of Violent Incidents in North Carolina Targeting Political 
Institutions in Early 2017 Due to Close of the Election Period 

(U//FOUO) In the final months of the 2016 election cycle, specifically the beginning of September through the 
beginning of November 2016, North Carolina public political institutions and figures experienced a spike of both 
threats and violent activity that involved targeting of campaign office facilities. In the year prior to the first 
incident, there appears to have been limitied to no reporting of similar activity. The ISAAC assesses that criminal 
and violent incidents targeting those institutions are likely to decrease in first half of 2017 as compared to the last 
half of 201 6, due namely to the conclusion of the election and peaceful transitions of government and state and 
federal levels as well as the cessation in violent acts. 
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(U//FOUO) Threats of violence and acts that may have been intended to intimidate individuals associated with 
party offices took place in several parts of the state during the last quarter of 2016, according to corroborated 
media and reliable law enforcement reporting. Tactics used in recent criminal activities targeting political 
institutions in North Carolina have been mostly simple, using readily available materials, requiring little expertise 
or training. Examples of some of the violent incidents that occurred in the state include: 

• (U) An unidentified individual or individuals shot and damaged the windows of a headquarters office for a 
major political party in Pamlico County on at least two occasions during September and October 2016, 
according to a statement released by party county chairman. 1 ’ 2 

• (U) On 20 October 2016, an individual was arrested on state charges related to terrorism and filing false 
reports after he allegedly called in a bomb threat to a political party headquarters in Henderson County 
according to media reporting. 3 

• (U//FOUO) During the night of 1 7 October 201 6, an unidentified actor fired a non-lethal weapon at the state 
headquarters for a political party in downtown Raleigh, damaging some of the signage infrastructure 
according to law enforcement reporting. 4 

• (U) In the early morning of 16 October in Orange Country, unidentified individuals threw improvised 
incendiary devices (IIDs) — Molotov cocktails — through the large picture window of the local political party 
office. At least one of the devices broke and ignited inside the office, causing extensive damage before 
self-extinguishing. The office was empty at the time of the attack and no one was injured, but the attack 
caused significant property damage. Additionally, the perpetrator(s) spray-painted "Nazi Republicans leave 
town or else" on a nearby building, according to media and law enforcement reporting. 5 6 

(U//FOUO) In the two months leading up to the 2016 election, North Carolina experienced several incidents of 
individuals targeting campaign offices — in many cases damaging property. Limited to no reporting has been 
received by the ISAAC indicated the targeting or attempted disruption of similar offices prior to September 2016 
through the time of publication for this product. In spite of the increased violence/as in past election years, the 
ISAAC lacks credible indications of near-term domestic terrorism threats against political entities such as 
campaign offices, party headquarters, associated facilities, or in North Carolina now that the Presidential and 
Gubanotorial campaign has ended. The conclusion of the campaign and election process will result in the 
cessasation of the daily barrage of negative campaign ads and political rhetoric, which likely contributed to 
incitement of at least some of the violent and/or criminal incidents. Traditional government institutions involved 
in the implementation of what may be perceived, by some extremists, as controversial policies are likely to be 
viewed by those individuals as high value targeting during the non-election cycle years. Lower rates of incident 
reporting following the election also supports this assessement. 

(U//FOUO) North Carolina Government Institutions Also Target of Politically-Motivated Cyber 
ActivityExperience 

(U//FOUO) The ISAAC assesses that some malicious cyber activity targeting public sector — particularly 
government — entities in the last half of 2016 may have been politically-motivated. This assessment is based on 
the same reasons mentioned in the physical threats section, including diminished political rhetoric and 
associated negative publicity. The activities specifically pursued political aims and/or intended to intimidate, 
harass, disrupt and/or steal data from information technology networks, according to DHS reporting. 

• (U//FOUO) During early October 201 6, a criminal hacker defaced a North Carolina law enforcement website 
by gaining access and posting pro-Turkey messaging. 7 

• (U//FOUO) In late September 201 6, a criminal hacker group attempted to influence a North Carolina city 
government’s law enforcement response decisions by threatening to leak government personnel records. It 
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was determined that the criminal actor was not able to successfully exfiltrate any data and thereby did not 
possess any sensitive records. 8 

• (U//FOUO) A distributed denial of service (DDoS) attack against a website associated with a city in 
southwestern North Carolina on 21-22 September significantly degraded the website’s functionality and 
impacted connectivity. The time frame of this incident coincided with nationally-publicized civil unrest taking 
place in the area that resulted in veiled and open threats to government institutions. 9 

(U//FOUO) Outlook and Implications 

(U//FOUO) In the lead up to and immediately following the 2016 election, North Carolina experienced incidents 
that included the targeting of political campaign offices and government organizations highlight their 
attractiveness as targets for domestic terrorists and various cyber actors seeking to advance political aims and/or 
influence government operations. In spite of this, we assess that political campaign offices in North Carolina are 
likely to see a decrease in targeting against their facilities in the first half of 201 7. While ISAAC has no evidence 
at this time indicating that past attacks will inspire further violence in North Carolina, we urge law enforcement to 
remain vigilant and report indicators of suspicious activity at locations and events deemed likely targets for 
attacks. Malicious cyber activities directed against government institutions are likely to occur at consistent levels 
that have been observed over the last few years. 


(U//FOUO) DHS l&A Perspective 


(U//FOUO) DHS assesses that anger over the results of the 201 6 Presidential election continues to 
be a driver of domestic terrorist violence throughout the United States — as evidenced by rioting in 
Portland, Oregon following the election and violence and destruction of property in Washington 
during the Inauguration. 1011 While we agree that the campaign cycle likely was a driving influence of 
the rash of incidents in NC in the lead up to the election, we cannot discount the possibility that some 
such individuals could be spurred to violence against a variety of political targets in the state in the 
coming year. While criticism and dissenting views of the government is protected activity, some 
individuals have engaged in violent or unlawful action to express these views. We assess there may 
be other factors or occurrences that could foment further criminal acts and violence against political 
entities in North Carolina: 

(U//FOUO) Negative publicity surrounding perceived political scandal involving North Carolina 
political entities; 

(U//FOUO) Passage of new state or federal legislation that is unpopular with violent extremists — 
such as legislation concerning: abortion rights, LGBT rights, environment al concerns, gun 
control, or federal health insurance among others; 

(U//FOUO) Perceived success in violent activity during the 2017 Presidential inauguration that 
energized local and regional violent extremists; and 

(U//FOUO) Negative publicity surrounding voting registration in North Carolina during the 
previous 2016 Presidention election. 


(U) DHS and the North Carolina ISAAC are interested in receiving tips and information on activities 
related to threats to homeland security, malicious cyber activity, and foreign-inspired or domestic 
terrorism. Comments, requests, or shareable intelligence should be directed to the ISAAC (for North 
Carolina activities 888-NCISAAC) or DHS. 
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(U//FOUO) Source Summary Statement 

(U//FOUO) The information used in this FAR is drawn from DHS, open source information, state and local law enforcement 
police reports, and press releases. We have high confidence in the information obtained from intelligence community, 

DHS, and other US Government and law enforcement agencies. We have medium confidence in the information obtained 
from open sources includes media reports and websites whose information is credibly sourced and plausible, but may 
contain biases or unintentional inaccuracies. When possible, open source information has been corroborated through other 
reliable law enforcement and judicial sources. 

(U//FOUO) The judgments are guided by the following parameters: 

• (U) High confidence includes high-quality information from multiple sources or from a single, highly reliable source, 
and the nature of the issue makes it possible to render a strong judgment. 

• (U) Medium confidence includes information that is credibly sourced and plausible but can be interpreted in various 
ways, or information that is not sufficient quality or corroborated sufficiently to warrant a higher level of confidence. 

• (U) Low confidence includes information that lacks credibility and/or whose plausibility is questionable, information 
that is too fragmented or poorly corroborated to make strong analytic judgments, or significant concerns or problems 
exist with the sources of the information. 

(U//FOUO) We have medium confidence in our assessment that physical violence against political organizations is likely 
to decrease in the first half of 201 7 as it is based on a lack of threat recent threat reporting and our judgments about 
domestic terrorists targeting preferences as SMEs on the topic. We acknowledge that this lack of threat reporting could also 
partially be the result of the inherent difficulties in obtaining comprehensive domestic terrorism reporting as a result of 
privacy and civil rights restrictions on USPER data. 

(U//FOUO) We have medium confidence in our assessment that malicious cyber activities in the first half of 2017 directed 
at government networks will likely continue at a similar rate but will be more focused on criminal rather than political aims as 
it is based largely onon our judgments regarding the goals of cyber actors as SMEs on the topic; these judgments have 
been corroborated by DHS MR reporting that is deemed credible by other cyber experts. 


(U) Report Suspicious Activity 


(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency 
managers should follow established protocols; all other personnel should call 911 or contact local law 
enforcement. Suspicious activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism 
Task Force for further action. For more information on the Nationwide SAR Initiative, visit 
http://nsi.ncirc.gov/resources.aspx. 


(U) Tracked by: HSEC-8.1 , HSEC-8.6, HSEC-8.8, HSEC-8.10 


UNCLASS 


FIED//FOR OFFICIAL USE 


ONLY 


Page 4 of 5 



UNCLASSIFIED//FOR OFFICIAL USE ONLY 


1 (U); Chris Dyches; WBTV.com; “Shots Fired at Republican Headquarters in Pamlico County”; 19 OCT 
2016; http://www.wbtv.com/story/33428361/ncgop-shots-fired-at-republican-headquarters-in-pamlico-county; 
accessed on 11 JAN 2017; (U); Online news article from local news blog. 

2 (U); Caryn Little; WCCB-TV; “Officials Say Shots Fired into Pamlico County Republican Party 
Headquarters”; 19 OCT 2016; http://www.wccbcharlotte.com/2016/10/19/officials-say-shots-fired-pamlico- 
county-republican-party-headquarters/; accessed on 1 1 JAN 2017; (U); Online news article from local news 
source. 

3 (U); Kristy Steward; WLOS TV; “Police: Arrest made after Henderson County GOP office bomb threat”; 20 
OCT 2016; http://wlos.com/news/local/henderson-county-gop-office-evacuated-after-threat; accessed on 11 
JAN 2017; (U); Online news article from local news source. 

4 (U//FOUO); Raleigh Police Department; 18 OCT 2016; (U//FOUO) Report # LRP1 61 01 8381 897; Extracted 
information is U//FOUO; Overall document classification is U//FOUO. 

5 (U); Eric Bradner; CNN, “Local GOP office in North Carolina firebombed,” 17 OCT 2016; 
http://www.cnn.com/2016/10/16/politics/north-carolina-gop-office-vandalized/; accessed on 11 JAN 2017; 
(U); Online news article from national news source. 

6 (U); FBI, Arson and Graffiti Investigation - Hillsborough, North Carolina; n.d.; 
https://www.fbi.gov/wanted/seeking-info/arson-and-graffiti-investigation; accessed on 11 JAN 2017; 

(U); Official government website. 

7 (U//FOUO); DHS; MR 4 015 0040 17; 062001 Z DEC 2016; DOI 03 OCT 2016; (U//FOUO); Defacement of 
North Carolina Law Enforcement Training Academy Website in October 2016; Extracted information is 
U//FOUO; Overall document classification is U//FOUO. 

8 (U//FOUO); DHS; MR 4 015 0036 17; 021802Z DEC 2016; DOI 27 SEP 2016; (U//FOUO); Attempted 
Exfiltration of Personal Information from a North Carolina City’s Computer Network to Use for Extortion; 
Extracted information is U//FOUO; Overall document classification is U//FOUO. 

9 (U//FOUO); DHS; IIR 4 015 0035 17; 021725Z DEC 2016; DOI 03 OCT 2016; (U//FOUO); Distributed 
Denial of Service Attack Directed Against a City in Southwestern North Carolina During a Period of Unrest in 
September 2016; Extracted information is U//FOUO; Overall document classification is U//FOUO. 

10 (U); Unknown Author; CBS News, “Riot Declared in Portland, Oregon Amid NewWave of Anti-Trump 
Demos,” 11 NOV 2016; http://www.cbsnews.com/news/riot-declared-in-portland-oregon-amid-new-wave-of- 
anti-trump-demos/; accessed on 1 1 JAN 2017; (U); Online news article from national news source. 

11 (U); Chris York; Huffington Post, “Donald Trump Protests See Anarchists Smash Windowns in 
Washington” 20 JAN 2016; http://www.huffingtonpost.co.uk/entry/donald-trump-inauguration- 
protests_uk_58822fd9e4b0f94bb303c845; accessed on 01 JAN 2017; (U); National news blog. 


UNCLASS 


FI ED//FOR OFFICIAL USE 


ONLY 


Page 5 of 5 



CLASSIFICATION: 



lATION: UNCLASSIFIED//FOR OFFICIAL USE ONLY 


i Homeland 


Office of Intelligence and Analysis 

Customer Feedback Form 



Product Title: (U//FOUO) North Carolina: Recent Spike in Election-related Physical and Cyber Incidents 

All survey responses are completely anonymous. No personally identifiable information is captur 
voluntarily offer personal or contact information in any of the comment fields. Additionally, your i 
combined with those of many others and summarized in a report to further protect your anonymity. 



Very 

Satisfied 


Somewhat 

Satisfied 


Neither 
Satisfied nor 
Dissatisfied 


Somewhat 

Dissatisfied 


Very 

Dissatisfied 


N/A 


Product’s overall usefulness 

O 

o 

o 

O 

o 

o 

Product’s relevance to 
your mission 

O 

o 

o 

o 

o 

o 

Product’s timeliness 

o 

o 

o 

o 

o 

o 

Product’s responsiveness 
to your intelligence needs 

o 

o 

o 

o 

o 

o 

5. How do you plan to use this product in support of your mission? (Check ail that apply.) 

□ Drive planning and preparedness efforts, training, and/or 

□ Initiate a law enforcement investigation 



emergency response operations 

□ Observe, identify, and/or disrupt threats 
□Share with partners 

□Allocate resources (e.g. equipment and personnel) 

□ Reprioritize organizational focus 
□Author or adjust policies and guidelines 


□ Intiate your own regional-specific analysis 

□ Intiate your own topic-specific analysis 

n Develop long-term homeland security strategies 

□ Do not plan to use 

□ Other: 


6. To further understand your response to question #5, please provide specific details about situations in which you might 
use this product. 


7. What did this product not address that you anticipated it would? 


8. To what extent do you agree with the following two statements? 


Strongly 

Agree 


Agree 


Neither Agree 

nor Disagree Disagree 


Strongly 
Disgree N/A 


This product will enable me to make 
better decisions regarding this topic. 


O 


O 


o 


o 


o o 


This product provided me with intelligence 
information I did not find elsewhere. 


O 


O 


o 


o 


To help us understand more about your organization so we can better tailor future products , please provide: 

Name: 

Organization: 

Number: 


Privacy Act Statement 
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9. How did you obtain this product? 

Select One 

10. Would you be willing to participate in a follow-up conversation about your feedback? 

Yes 
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